n8n versions prior to 1.123.32, and certain 2.x versions before 2.17.4 and 2.18.1, contain SQL injection vulnerabilities in the Snowflake and legacy MySQL v1 nodes. These nodes improperly construct SQL queries by directly interpolating user-controlled identifiers without escaping, allowing attackers to execute arbitrary SQL commands if they can control workflow inputs. Exploitation requires specific workflow configurations with untrusted input passed into identifier fields. The vulnerability can lead to data exfiltration, modification, or deletion in the connected databases. Fixed versions are 1.123.32, 2.17.4, and 2.18.1. Temporary mitigations include restricting workflow editing, migrating to MySQL v2 node, disabling the Snowflake node, and avoiding unvalidated user input in affected fields.